ci.yml

name: CI

on:
  pull_request:
    branches: [develop]
    paths-ignore:
      - README.md
      - CHANGELOG.md
      - LICENSE
  push:
    branches: [develop]
    paths-ignore:
      - README.md
      - CHANGELOG.md
      - LICENSE
  workflow_dispatch:

permissions: read-all

env:
  GO_VERSION: '1.26.4'

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: go.sum

      - run: go version

      - name: golangci-lint
        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
        with:
          version: v2.12.2
          args: --timeout=5m0s --config .golangci.yaml

      - name: Static security analysis
        run: make security-code

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: go.sum

      - run: go version

      - name: Run unit tests
        run: make test

      - name: Check formatting
        run: make fmt-check

  docker-smoke:
    name: Docker smoke (${{ matrix.slug }})
    runs-on: ubuntu-latest
    needs: [lint, test]
    strategy:
      fail-fast: false
      matrix:
        include:
          - slug: amd64
            platform: linux/amd64
            dockerfile: Dockerfile
          - slug: arm64
            platform: linux/arm64
            dockerfile: Dockerfile
          - slug: armv7
            platform: linux/arm/v7
            dockerfile: Dockerfile.edge
          - slug: riscv64
            platform: linux/riscv64
            dockerfile: Dockerfile.edge
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: ./.github/actions/set-build-env
        env:
          IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY }}
          ROUTER_CONTAINER_IMAGE: ${{ vars.ROUTER_CONTAINER_IMAGE }}
          OCI_SOURCE_REPO: ${{ vars.OCI_SOURCE_REPO }}
          ROUTER_DISTRIBUTION: ${{ vars.ROUTER_DISTRIBUTION }}
          ROUTER_GITHUB_REPO: ${{ vars.ROUTER_GITHUB_REPO }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Build and load image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: ${{ matrix.platform }}
          load: true
          push: false
          cache-from: type=gha,scope=router-${{ matrix.slug }}
          cache-to: type=gha,mode=max,scope=router-${{ matrix.slug }}
          build-args: |
            OCI_SOURCE_REPO=${{ env.OCI_SOURCE_REPO }}
            OCI_VERSION=ci
            OCI_REVISION=${{ github.sha }}
            ROUTER_DISTRIBUTION=${{ env.ROUTER_DISTRIBUTION }}
          tags: ${{ env.ROUTER_CONTAINER_IMAGE }}:ci-smoke-${{ matrix.slug }}

      - name: Runtime smoke (router → launch.sh → skrouterd)
        env:
          IMAGE: ${{ env.ROUTER_CONTAINER_IMAGE }}:ci-smoke-${{ matrix.slug }}
          PLATFORM: ${{ matrix.platform }}
        run: |
          set -euo pipefail
          docker run -d --name router-smoke --platform "${PLATFORM}" \
            -e SKUPPER_PLATFORM=kubernetes \
            -v "${GITHUB_WORKSPACE}/test/smoke-skrouterd.json:/tmp/skrouterd.json:ro" \
            "${IMAGE}"
          cleanup() { docker rm -f router-smoke >/dev/null 2>&1 || true; }
          trap cleanup EXIT
          for _ in $(seq 1 30); do
            if docker logs router-smoke 2>&1 | grep -q "Listening on 0.0.0.0:5672"; then
              echo "Runtime smoke passed: skrouterd listening on :5672"
              exit 0
            fi
            if ! docker ps -q -f name=router-smoke | grep -q .; then
              echo "Container exited before skrouterd became ready"
              docker logs router-smoke 2>&1 || true
              exit 1
            fi
            sleep 2
          done
          echo "Timed out waiting for skrouterd to listen on :5672"
          docker logs router-smoke 2>&1 || true
          exit 1